Attackers started dropping webshells through Elementor Pro forms on patch day

The bypass needs no account. Wordfence's description of the request is the whole exploit: the File Upload field is submitted as an array, the first element is empty, the second carries a PHP payload with a .php filename, and the plugin stops validating after the empty entry ^[5]. The file lands in /wp-content/uploads/elementor/forms/ under a randomly generated name that keeps the attacker-supplied extension, and the attacker then requests it directly to run commands ^[9]. The only prerequisite is a published Elementor Pro Form widget with at least one File Upload field, which the reporting describes as a common configuration ^[8].

The volume says what kind of activity this is. Wordfence counted more than 190,000 blocked attempts between August 19 and 23, and close to 200,000 since the patch shipped ^[7][6]. That puts roughly 95 percent of the total inside a five-day window ^[15], averaging about 38,000 a day ^[16], with the remaining 10,000 or so spread across everything after August 23 ^[17]. That profile matches opportunistic scanning against a fixed path.

Two caveats on the 200,000. It is Defiant's own client telemetry, not the more than 6 million active installations attributed to the plugin ^[6][1]. And blocked attempts are requests, not victims: a single target can absorb thousands, and any site without a WAF in front of it contributes nothing to the count at all.

Patchstack flagged the arbitrary PHP upload and code execution path last month ^[12]. Wordfence supplied the exploitation timeline, placing first activity on August 19, the same day Elementor released 4.2.2 ^[11][2]. The interval between fix availability and attack traffic was therefore zero days ^[14]. For anyone running a staged or monthly update cadence on client sites, the patch was never ahead of the scanning.

Upgrading closes the write path but leaves on disk anything written before the upgrade, and the indicator here is unusually clean. That directory exists to store form submissions, so a PHP file in it is a strong indicator of compromise and a trigger for clean-up rather than a finding to weigh ^[10]. Versions 4.2.1 and earlier are affected ^[3], the outcome is a webshell and arbitrary command execution ^[4], and the IP list Wordfence published is worth loading for edge noise reduction ^[13] while saying nothing about what was already written.

The set that needs a file-level check is narrower than the install base: sites that had a published upload form live on August 19 ^[8][2]. Most agencies can produce that list from their own build records faster than they can run a scanner across every tenant.